springboot spring-boot-dependencies 2.2.5 breaks selenium-chrome-driver

After upgrading our project to spring-boot-dependencies 2.2.5.RELEASE, the Selenium Chrome Driver is broken.

Details: The class org.openqa.selenium.chrome.ChromeOptions uses com.google.common.collect.ImmutableList#toImmutableList() which is not available in the current version of Guava. That version is a dependecy of com.github.ben-manes.caffeine:guava:2.8.1 declared by spring-boot-dependencies.

Comment From: wilkinsona

Thanks for the report. Spring Boot doesn't have an opinion about the version of Guava that you should use so it'll be determined transitively by whatever dependencies you're using. Maven will pick the version that's nearest to the root of the dependency graph. Gradle will pick the latest. If this behaviour isn't giving you a version that meets your needs, you should add some of your own dependency management to control Guava's version.

Unfortunately, Guava is widely used, releases regularly, and those releases often contain breaking API changes. This makes using it as a dependency (as Caffeine's Guava module and Selenium's Chrome Driver apparently do) quite risky. You may want to encourage those project to look at an alternative or to repackage Guava so that they are not exposed to the API compatibility problems that it can cause.

Comment From: windmueller

Thank you for the fast reply.

Further investigation shows that this was caused by importing the BOM of spring-cloud-dependencies and not spring-boot-dependencies. I fixed it with

dependencyManagement {
    dependencies {
        // Newer versions of Guava break selenium-chrome-driver (3.141.59)
        dependency group: 'com.google.guava', name: 'guava', version: '28.1-jre'
    }
    imports {
        mavenBom org.springframework.boot.gradle.plugin.SpringBootPlugin.BOM_COORDINATES
        mavenBom 'org.springframework.cloud:spring-cloud-dependencies:Hoxton.SR3'
    }
}